From the comments, it seems the passwords were hashed but they're (rightly) still concerned.

Unfortunately, there still seems to be some confusion about when/if the password reset has taken place, and whether users should change them now, wait for Dreamhost, or both (and then update them again after the reset!)